diff --git a/advisories/unreviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json b/advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json similarity index 55% rename from advisories/unreviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json rename to advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json index 48cbe7f69f3..49d4c618f5d 100644 --- a/advisories/unreviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json +++ b/advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json @@ -1,26 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-9gq6-6936-885w", - "modified": "2024-09-12T15:33:00Z", + "modified": "2024-09-12T17:03:57Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45848" ], + "summary": "MindsDB Eval Injection vulnerability", "details": "An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mindsdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "23.12.4.0" + }, + { + "fixed": "24.7.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45848" }, + { + "type": "WEB", + "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mindsdb/mindsdb" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" @@ -31,8 +62,8 @@ "CWE-95" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-12T17:03:57Z", "nvd_published_at": "2024-09-12T13:15:13Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json b/advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json similarity index 57% rename from advisories/unreviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json rename to advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json index f77c211377d..900f25ee716 100644 --- a/advisories/unreviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json +++ b/advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json @@ -1,26 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-c85f-pcx6-2ghm", - "modified": "2024-09-12T15:33:00Z", + "modified": "2024-09-12T17:03:55Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45849" ], + "summary": "MindsDB Eval Injection vulnerability", "details": "An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mindsdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "23.10.5.0" + }, + { + "fixed": "24.7.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45849" }, + { + "type": "WEB", + "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mindsdb/mindsdb" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" @@ -31,8 +62,8 @@ "CWE-95" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-12T17:03:55Z", "nvd_published_at": "2024-09-12T13:15:13Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json b/advisories/github-reviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json similarity index 55% rename from advisories/unreviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json rename to advisories/github-reviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json index 2bad0e0b2ac..eb7a7d8d96d 100644 --- a/advisories/unreviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json +++ b/advisories/github-reviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json @@ -1,26 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-crmg-rp64-5cm3", - "modified": "2024-09-12T15:33:00Z", + "modified": "2024-09-12T17:03:59Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45847" ], + "summary": "MindsDB Eval Injection vulnerability", "details": "An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mindsdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "23.11.4.2" + }, + { + "fixed": "24.7.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45847" }, + { + "type": "WEB", + "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mindsdb/mindsdb" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" @@ -31,8 +62,8 @@ "CWE-95" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-12T17:03:59Z", "nvd_published_at": "2024-09-12T13:15:13Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json b/advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json similarity index 57% rename from advisories/unreviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json rename to advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json index afeb701efbc..03a15966b58 100644 --- a/advisories/unreviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json +++ b/advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json @@ -1,26 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-v6g6-3cm3-vf6c", - "modified": "2024-09-12T15:33:00Z", + "modified": "2024-09-12T17:03:53Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45850" ], + "summary": "MindsDB Eval Injection vulnerability", "details": "An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for site column creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mindsdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "23.10.5.0" + }, + { + "fixed": "24.7.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45850" }, + { + "type": "WEB", + "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mindsdb/mindsdb" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" @@ -31,8 +62,8 @@ "CWE-95" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-12T17:03:53Z", "nvd_published_at": "2024-09-12T13:15:13Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json b/advisories/github-reviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json similarity index 55% rename from advisories/unreviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json rename to advisories/github-reviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json index 0f2a5e603a7..6ecc1746562 100644 --- a/advisories/unreviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json +++ b/advisories/github-reviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json @@ -1,26 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-wcjw-3v6p-4v3r", - "modified": "2024-09-12T15:33:00Z", + "modified": "2024-09-12T17:04:01Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45846" ], + "summary": "MindsDB Eval Injection vulnerability", "details": "An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mindsdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "23.10.3.0" + }, + { + "fixed": "24.7.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45846" }, + { + "type": "WEB", + "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mindsdb/mindsdb" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" @@ -31,8 +62,8 @@ "CWE-95" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-12T17:04:00Z", "nvd_published_at": "2024-09-12T13:15:12Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json b/advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json similarity index 57% rename from advisories/unreviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json rename to advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json index bc67311fd42..a1062131926 100644 --- a/advisories/unreviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json +++ b/advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json @@ -1,26 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-wf9g-c67g-h4ch", - "modified": "2024-09-12T15:33:01Z", + "modified": "2024-09-12T17:03:51Z", "published": "2024-09-12T15:33:01Z", "aliases": [ "CVE-2024-45851" ], + "summary": "MindsDB Eval Injection vulnerability", "details": "An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list item creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mindsdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "23.10.5.0" + }, + { + "fixed": "24.7.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45851" }, + { + "type": "WEB", + "url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mindsdb/mindsdb" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" @@ -31,8 +62,8 @@ "CWE-95" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-12T17:03:51Z", "nvd_published_at": "2024-09-12T13:15:14Z" } } \ No newline at end of file